Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
09-03-2024 22:41
General
-
Target
61f9728b33b9d17653db8ee0b59ff8edff321ad99208f5173054191ce836e1c7.exe
-
Size
98KB
-
MD5
8ad3191c3270d52a98dc8a2239738697
-
SHA1
20062d75a573d3cc9a0889f87114a353a2a9048c
-
SHA256
61f9728b33b9d17653db8ee0b59ff8edff321ad99208f5173054191ce836e1c7
-
SHA512
3b9e6578c6516b0be383deb7f4086f18aff44c01e160190bce5431398657039ff1479020d919d4e2807da778ff295da38fc8ab56ea60b1dadfee9e8c46aa7c37
-
SSDEEP
1536:4Cd+qitb0bt+FTCQ2j9EvHsdX+u1X20n2eN6wrBXBuOkD8Ovb8:H4b0hR9EE1+u1X2q2e3r/
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\61f9728b33b9d17653db8ee0b59ff8edff321ad99208f5173054191ce836e1c7.exe"C:\Users\Admin\AppData\Local\Temp\61f9728b33b9d17653db8ee0b59ff8edff321ad99208f5173054191ce836e1c7.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\conwurm.exe"C:\Users\Admin\AppData\Local\Temp\conwurm.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98KB
MD52f8302646dc388bee52dd4b372163eb2
SHA1383718d89b41389287ed70430255d1b94dac45be
SHA256fe08b1d2af93c61fcfea9486cd99117567a59753a5f1fd87e5863601cf108cea
SHA51202503dc5ce1fde0e37b929af635e1084b5603a9d8690e8305d625945e9e6a7e3a336a605223c90a1576c1deacb0b4eb60cffe9166926f9bd49a2b643a13b5dff
-
Filesize
84KB
-
Filesize
20KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
20KB
-
Filesize
20KB
-
Filesize
84KB